Protecting directories after uploads

[asantos]

Hi,
i've implemented a system that lets the users upload their profile pictures to a specific directory.

Everythng works alright on the development server. Once online, i knew i had to set the picture's directory to 755 (for security reasons)... bad news is, in the moment a user uploads a picture, it has to be temporary set to 777. This is what im using:

...
@chmod($dir,0777);
imageJPEG($temp,$dir.$id.'.jpg',90);
@chmod($dir,0755);
...

Where:
$dir is the directory that holds the pictures
$temp,$dir.$id.'.jpg' could be $dir/745.jpg

Is there a better way?

[nowpc]

Who owns the directory? Are you able to add the Apache process to a group with write permissions? That would stop you having to chmod - a messy solution at best.

[asantos]

hi nowpc,
actually i had to buy a dedicated virtual server to have access to this feature.

could you give me a hand with the command to add the Apache process to a group with write permissions?

thanks!
andres

[bkeep]

setup your server to use suExec and suphp

suExec provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web-server. Normally, when a CGI or SSI program executes, it runs as the same user who is running the web server.

suPHP is a tool for executing PHP scripts with the permissions of their owners. It consists of an Apache module (mod_suphp) and a setuid root binary (suphp) that is called by the Apache module to change the uid of the process executing the PHP interpreter.

What management software is on your dedicated server? cPanel Plesk Directadmin?

[asantos]

Hi bkeep, i have Plesk.

They are still configuring the settings though. As soon as it is ready i will try installing suExec and suPHP.

Any starting point tips?

I need to set this permissions to the Apache process to one directory (and all its subdirectories).

[bkeep]

When you use suPHP and suExec they will automatically run the script as the user account that owns them

So for an example I create a hosting account with a username of example all scripts and files in example's home directory and webroot are owned by the username example.

so if I go to example.com/someScriptThatDoesStuff.php and it is performing an upload the resulting file will be owned by example so it does not have to be world writable. I hope that makes sense.

I am not that familiar with Plesk. I would imagin there are some good tutorials on setting Apache up to utilize the security features maybe in the Plesk Forum but I am not sure.

Good luck